Static Application Security Testing (SAST) Directory

Static Application Security Testing (SAST) solutions are used to identify and fix security vulnerabilities in software applications. They can be used at all stages of the software development lifecycle, from development to testing to deployment.

Static Application Security Testing (SAST) reviews and rankings

Products

• Veracode
• SonarQube
• GitLab
• Checkmarx One
• PortSwigger Burp Suite Professional
• OpenText Core Application Security
• Snyk
• HCL AppScan
• Coverity Static
• OWASP Zap
• Qualys Web Application Scanning
• Invicti Web + API
• Parasoft SOAtest
• Invicti
• Klocwork
• Kiuwan
• Contrast Security Assess
• Rapid7 AppSpider
• Harness
• Semgrep
• Aikido Security
• Fortify Software Security Center
• Ixia BreakingPoint
• ImmuniWeb
• GitHub Code Scanning
• Checkmarx SAST
• Apiiro
• Cycode
• Ox Security
• Pentest-Tools.com
• SiteLock
• Appvance AIQ Platform
• FortiDevSec
• GuardRails
• NowSecure
• Parasoft Jtest
• Qwiet AI
• Software Risk Manager ASPM
• AIAST
• Appknox
• Arnica
• Astra Pentest
• Attackflow
• Bearer
• Bright
• Checkmarx IaC Security / KICS
• CloudDefense SAST
• CodeScan Static Code Analysis
• Cyber Chief
• Data Theorem API Secure
• DeepSource
• Endor Labs
• esChecker
• Fortra's Beyond Security BeSource
• Indusface WAS
• Ixia BreakingPoint VE
• Jit.io
• Kodem's Dynamic SCA
• Kodem's SAST
• PT Application Inspector
• PVS‑Studio
• Q-mast
• Quotium Seeker
• Rainforest Application
• SISA
• Steampunk Spotter
• Syhunt Hybrid
• Visual Expert

Top comparisons

• Checkmarx One vs. SonarQube
• OpenText Core Application Security vs. SonarQube
• Coverity Static vs. SonarQube
• Snyk vs. SonarQube
• SonarQube vs. Veracode
• Semgrep vs. SonarQube
• Checkmarx One vs. Veracode
• Checkmarx One vs. Checkmarx SAST
• GitLab vs. SonarQube
• Invicti Web + API vs. PortSwigger Burp Suite Professional
• Invicti Web + API vs. OWASP Zap
• OWASP Zap vs. SonarQube
• Klocwork vs. SonarQube
• Checkmarx One vs. OpenText Core Application Security
• Coverity Static vs. Klocwork
• HCL AppScan vs. Veracode
• Checkmarx One vs. Snyk
• PortSwigger Burp Suite Professional vs. Software Risk Manager ASPM
• Coverity Static vs. Veracode
• OWASP Zap vs. PortSwigger Burp Suite Professional
• Kiuwan vs. SonarQube
• Snyk vs. Veracode
• GitHub Code Scanning vs. SonarQube
• PortSwigger Burp Suite Professional vs. SonarQube
• OpenText Core Application Security vs. Veracode
• GitLab vs. Veracode
• Checkmarx One vs. HCL AppScan
• Endor Labs vs. Snyk
• Aikido Security vs. SonarQube
• Qualys Web Application Scanning vs. SonarQube
• HCL AppScan vs. SonarQube
• OWASP Zap vs. Veracode
• GitLab vs. Snyk
• HCL AppScan vs. Invicti Web + API
• OWASP Zap vs. Qualys Web Application Scanning
• Cycode vs. Snyk
• Invicti vs. Invicti Web + API
• Invicti vs. Veracode
• Ox Security vs. Snyk
• Aikido Security vs. Semgrep
• Semgrep vs. Snyk
• Checkmarx One vs. OWASP Zap
• Apiiro vs. Snyk
• HCL AppScan vs. PortSwigger Burp Suite Professional
• Coverity Static vs. OpenText Core Application Security
• Checkmarx One vs. Fortify Software Security Center
• Aikido Security vs. Snyk
• Checkmarx One vs. GitLab
• Checkmarx One vs. Invicti Web + API
• Apiiro vs. Cycode

Questions

• Why is Application Security Testing (AST) important for companies?
• What tools are you using as a CISO to measure Cybersecurity Performance?
• Is there a single tool to unify cloud compliance reporting?
• How can I best get visibility and control of complex or distributed cloud environments?
• Do you use Fuzzbuzz, ForAllSecure or another fuzzing tool? How has your experience been?
• What tools do you recommend to use for mobile penetration testing in 2022?
• What does the Log4j/Log4Shell vulnerability mean for your company?
• What is the difference between SAST and SCA tools?
• What are your recommended automated penetration testing tools?
• What is your recommended static code analysis tool for JavaScript and C/C++?
• What is the best Application Security Testing platform?
• What tools do you rely on for building a DevSecOps pipeline?
• SAST vs. DAST: Which is better for application security testing?
• What are the OWASP top 10 in 2020?
• What Application Security Solution Do You Use That Is DevOps Friendly?
• Difference between IBM Appscan and HP fortify software
• When evaluating Application Security Testing, what aspect do you think is the most important to look for?
• Which is the most comprehensive open source Web Security Testing tool?
• Checkmarx or Veracode. Which should we choose?

Articles

• Application Security Testing (AST) - Tech Leaders
• Community Spotlight #19
• What is OWASP Top 10 in 2022
• What are the best application security testing tools?